CVE-2009-3564
puppetmasterd in puppet 0.24.6 does not reset supplementary groups when it switches to a...
CVE-2009-3564 is a medium vulnerability (CVSS 4.7) in Reductivelabs Puppet, published October 6, 2009. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.38%, the 31st percentile. Fixed in puppet 0.25.1-3.
puppetmasterd in puppet 0.24.6 does not reset supplementary groups when it switches to a different user, which might allow local users to access restricted files.
Exploit likelihood
What each source reports
NVD Score used
puppetmasterd in puppet 0.24.6 does not reset supplementary groups when it switches to a different user, which might allow local users to access restricted files.
- Record
CVE-2009-3564- CVSS 2.0
- 4.7 Medium
AV:L/AC:M/Au:N/C:C/I:N/A:N - Weakness
- CWE-264
- Updated
- 2026-11-02
CVE List No score
puppetmasterd in puppet 0.24.6 does not reset supplementary groups when it switches to a different user, which might allow local users to access restricted files.
- Record
CVE-2009-3564- Updated
- 2026-11-02
EUVDEUVD-2009-3545 No score
puppetmasterd in puppet 0.24.6 does not reset supplementary groups when it switches to a different user, which might allow local users to access restricted files.
- Record
EUVD-2009-3545- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-6384-2w9h-qw8w No score
puppetmasterd in puppet 0.24.6 does not reset supplementary groups when it switches to a...
puppetmasterd in puppet 0.24.6 does not reset supplementary groups when it switches to a different user, which might allow local users to access restricted files.
- Record
GHSA-6384-2w9h-qw8w- Updated
- 2026-11-02
OSV No score
puppetmasterd in puppet 0.24.6 does not reset supplementary groups when it switches to a different user, which might allow local users to access restricted files.
- Record
CVE-2009-3564- Updated
- 2026-11-02
OSVDEBIAN-CVE-2009-3564 No score
puppetmasterd in puppet 0.24.6 does not reset supplementary groups when it switches to a different user, which might allow local users to access restricted files.
- Record
DEBIAN-CVE-2009-3564- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
puppetDebian:11 |
before 0.25.1-3 | 0.25.1-3 |
History
| When | Changed | Sources |
|---|---|---|
| 2026-11-03 | aliases | EUVD |
| 2026-11-02 | created | CVE List, GitHub Advisories, NVD, OSV |